CVE-2023-50897

CRITICAL
2026-01-05 [email protected]
9.1
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 05, 2026 - 14:15 nvd
CRITICAL 9.1

Tags

File Upload

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Meow Apps Media File Renamer allows Using Malicious Files.This issue affects Media File Renamer: from n/a through 5.7.7.

Analysis

Media File Renamer WordPress plugin (through 5.7.7) by Meow Apps allows administrators to upload files with dangerous types, achieving OS-level code execution with scope change. While admin access is required, the scope break makes this critical.

Technical Context

The plugin does not restrict file types during upload operations (CWE-434). An authenticated administrator can upload executable files (PHP, PHTML, etc.) that are served by the web server, achieving code execution beyond the WordPress application sandbox.

Affected Products

Media File Renamer by Meow Apps through 5.7.7

Remediation

Update to a patched version. Implement server-level upload restrictions. Enable WordPress application-level firewalls that block PHP file uploads.

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +46
POC: 0

Share

CVE-2023-50897 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy